Search — “Prince of Persia”

Semperis reports that Iranian state-sponsored Prince of Persia (also tracked as Infy) restarted operations on May 27 after a three-month pause, deploying a new C&C server and resuming data theft with its Tonnerre malware. A later Tornado second-stage server was identified in the US on Namecheap shared hosting, the first US-hosted C2 since 2016, and another Tornado second-stage server was later hidden behind Cloudflare. Tornado supports file theft through a Telegram bot, so defenders should watch for suspicious Telegram traffic and apply Semperis's published IoCs.